CVE-2026-4327

The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twizajaxcallback AJAX action's 'savesection' handler combined with the use of eval to execute user-supplied 'custom logic'...

EUVD-2026-83548

The The Welcomizer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to and including 2.8.1. This is due to missing authorization checks on the twizajaxcallback AJAX action's 'savesection' handler combined with the use of eval to execute user-supplied 'custom logic'...

CVE-2026-4327

The The Welcomizer WordPress plugin is vulnerable to Remote Code Execution in all versions up to and including 2.8.1 . The root cause is a missing current_user_can() capability check on the twiz_ajax_callback AJAX action's savesection handler, combined with the use of eval() to execute user-suppl...

Wordpress the-welcomizer plugin Cross-Site Scripting Vulnerabilities

a bug in Wordpress the-welcomizer plugin that allows to us to occur a Cross-Site Scripting on a Remote machin. Iran Hack Security Team & Islamic Republic Of Iran Security Team http://IranHack.Org & http://irist.ir/forum/ Wordpress the-welcomizer plugin Cross-Site Scripting Vulnerabilities...